Eric Pretorious
Regular Pleskian
A client is complaining of frequent HTTP 500 errors when viewing their WordPress web site.
Looking in the error_log for their domain, I discovered that there are three different types of errors that are occuring:
Generally, the error_log looks a lot like this:
What struck me as unusual about these errors is that many of the entries are duplicated and slightly out of order. e.g., The entry at [Tue Apr 09] 21:35:04 appears several times, intermixed with other entries from about the same time:
There appears to be a strong correlation between the timing of the messages above and these messages in /var/log/httpd/error_log. e.g.,
e.g., On June 23rd, the entries in the domain's error_log file also span the time period from 20:18 to 20:30:
The entries in /var/log/httpd/error_log seem to indicate that, for some reason, mod_fcgid is being killed and that, in turn, is causing the login.php script to terminate which, in turn, is causing index.php to time out while waiting for login.php to return.
All this begs two questions:
Looking in the error_log for their domain, I discovered that there are three different types of errors that are occuring:
-
Code:
[Tue Apr 09 21:34:57 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
-
Code:
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
-
Code:
[Tue Apr 09 21:36:20 2013] [warn] [client 189.162.161.205] mod_fcgid: can't apply process slot for /var/www/cgi-bin/cgi_wrapper/cgi_wrapper, referer: http://example.com/wp-login.php
Generally, the error_log looks a lot like this:
Code:
[Tue Apr 09 21:34:57 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:34:58 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:34:58 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:34:58 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:34:58 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:01 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:03 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:03 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:03 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [warn] [client 189.162.161.205] mod_fcgid: read data timeout in 45 seconds
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:05 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
What struck me as unusual about these errors is that many of the entries are duplicated and slightly out of order. e.g., The entry at [Tue Apr 09] 21:35:04 appears several times, intermixed with other entries from about the same time:
Code:
eric@eric-v5:~/Downloads$ grep '[Tue Apr 09] 21:35:04' error_log-example.com | grep wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
[Tue Apr 09 21:35:04 2013] [error] [client 189.162.161.205] Premature end of script headers: wp-login.php
eric@eric-v5:~/Downloads$ grep '[Tue Apr 09] 21:35:04' error_log-example.com | grep wp-login.php | wc -l
10
There appears to be a strong correlation between the timing of the messages above and these messages in /var/log/httpd/error_log. e.g.,
Code:
[Sun Jun 23 [COLOR="#00FF00"]20:18:20[/COLOR] 2013] [warn] mod_fcgid: process 15928 graceful kill fail, sending SIGKILL
[Sun Jun 23 [COLOR="#00FF00"]20:18:21[/COLOR] 2013] [warn] mod_fcgid: process 15922 graceful kill fail, sending SIGKILL
[Sun Jun 23 [COLOR="#00FF00"]20:18:21[/COLOR] 2013] [warn] mod_fcgid: process 15916 graceful kill fail, sending SIGKILL
...
[Sun Jun 23 [COLOR="#FF0000"]20:30:04[/COLOR] 2013] [warn] mod_fcgid: process 16507 graceful kill fail, sending SIGKILL
[Sun Jun 23 [COLOR="#FF0000"]20:30:04[/COLOR] 2013] [warn] mod_fcgid: process 16503 graceful kill fail, sending SIGKILL
[Sun Jun 23 [COLOR="#FF0000"]20:30:08[/COLOR] 2013] [warn] mod_fcgid: process 16515 graceful kill fail, sending SIGKILL
e.g., On June 23rd, the entries in the domain's error_log file also span the time period from 20:18 to 20:30:
Code:
eric@eric-v5:~/Downloads$ grep 'Jun 23' error_log-example.com | head -3
[Sun Jun 23 [COLOR="#00FF00"]20:18:07[/COLOR] 2013] [warn] [client 190.92.53.234] mod_fcgid: read data timeout in 45 seconds, referer: example.com/wp-login.php
[Sun Jun 23 [COLOR="#00FF00"]20:18:08[/COLOR] 2013] [warn] [client 178.137.116.223] mod_fcgid: read data timeout in 45 seconds, referer: example.com/wp-login.php
[Sun Jun 23 [COLOR="#00FF00"]20:18:09[/COLOR] 2013] [warn] [client 109.228.202.4] mod_fcgid: read data timeout in 45 seconds, referer: example.com/wp-login.php
eric@eric-v5:~/Downloads$ grep 'Jun 23' error_log-example.com | tail -3
[Sun Jun 23 [COLOR="#FF0000"]20:29:59[/COLOR] 2013] [error] [client 190.42.27.247] Premature end of script headers: wp-login.php, referer: example.com/wp-login.php
[Sun Jun 23 [COLOR="#FF0000"]20:29:59[/COLOR] 2013] [warn] [client 189.75.76.133] mod_fcgid: read data timeout in 45 seconds, referer: example.com/wp-login.php
[Sun Jun 23 [COLOR="#FF0000"]20:30:00[/COLOR] 2013] [error] [client 189.75.76.133] Premature end of script headers: wp-login.php, referer: example.com/wp-login.php
The entries in /var/log/httpd/error_log seem to indicate that, for some reason, mod_fcgid is being killed and that, in turn, is causing the login.php script to terminate which, in turn, is causing index.php to time out while waiting for login.php to return.
All this begs two questions:
- What is killing mod_fcgid?
- Why is mod_fcgid being killed?
Last edited: